Rex expression built with field extractor not working?

nkavouris — Mon, 24 Feb 2025 18:13:05 GMT

I have a reliable base query to find events containing the information I want.

I built a rex using the field extractor, but applying the rex expression in a search does not yield any results, the values(gts_percent) column is always blank

Sample query:

index="june_analytics_logs_prod" $serial$ log_level=info message=*hardware_controller*|
rex field=message "(?=[^G]*(?:GTS weight:|G.*GTS weight:))^(?:[^\.\n]*\.){7}\d+\w+,\s+\w+:\s+(?P<gts_percent>\d+)"|
convert rmunit(gts_percent)|
chart values(gts_percent) by _time

Sample raw_ result :

{"bootcount":8,"device_id":"XXX","environment":"prod_walker","event_source":"appliance","event_type":"GENERIC","local_time":"2025-02-20T00:47:48.124-06:00",
"location":{"city":"XX","country":"XX","latitude":XXX,"longitude":XXX,"state":"XXX"},
"log_level":"info","message":"martini::hardware_controller: GTS weight: 17.05kg, tare weight: 8.1kg, net weight: 8.95kg, fill weight: 6.8kg, percent: 100%\u0000",
"model_number":"XXX","sequence":403659,"serial":"XXX","software_version":"2.3.0.276","ticks":0,"timestamp":1740034068,"timestamp_ms":1740034068124}

I am trying to extract the bold value in the raw, Where is my rex messing up?

Re: Rex expression built with field extractor not working?

richgalloway — Mon, 24 Feb 2025 18:54:10 GMT

The field extractor and erex commands tend to create overly complicated expressions. This one should work.

| rex field=message "percent: (?<gts_percent>\d+)"

Re: Rex expression built with field extractor not working?

nkavouris — Mon, 24 Feb 2025 19:30:18 GMT

this worked like a charm!
thank you!

topic Rex expression built with field extractor not working? in Splunk Search

Rex expression built with field extractor not working?

Re: Rex expression built with field extractor not working?

Re: Rex expression built with field extractor not working?